CVE-2024-1709 -- CVSS 10.0 Vulnerability Briefing

CVE-2024-1709 | CVSS 10.0 (Critical) | Exploit: PoC available

What Is It

CVE-2024-1709 is a critical authentication bypass vulnerability in ConnectWise ScreenConnect versions 23.9.7 and earlier, a widely deployed remote desktop and access management platform.

Technical Detail

The flaw exists in an alternate path or channel within ScreenConnect's authentication mechanism, allowing an unauthenticated attacker to bypass login controls entirely and gain direct access to the application. Successful exploitation can expose confidential data or grant unauthorized control over systems managed through the ScreenConnect interface. Given that ScreenConnect is commonly used by managed service providers and IT administrators to access client endpoints, the blast radius of a successful attack extends well beyond the ScreenConnect host itself.

Exploitation Status

A proof-of-concept exploit is publicly available for this vulnerability. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog as of this writing. However, the availability of public PoC code for a CVSS 10.0 authentication bypass in a widely deployed remote access tool significantly lowers the barrier for exploitation and warrants urgent attention regardless of formal KEV designation.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. The nature of the vulnerability, targeting remote access infrastructure used heavily by managed service providers, makes it an attractive target for ransomware operators and initial access brokers, though no named groups have been formally attributed to exploitation of this CVE.

What To Do

Organizations running ConnectWise ScreenConnect should upgrade immediately to a version beyond 23.9.7, as ConnectWise released a patch addressing this vulnerability. If immediate patching is not possible, restrict access to the ScreenConnect interface at the network perimeter by limiting exposure to trusted IP ranges only. Detection efforts should focus on anomalous authentication events, unexpected administrative account creation, and unusual session activity within ScreenConnect logs. Given the CVSS score of 10.0 and public PoC availability, this should be treated as a patch-now priority with no deferral window.